cf2cbad1f955dc1576733d0398c8eb6985d940a53237ba1bb0be1ac1f2ad6281

Analysis

max time kernel
15s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbf5bdb17cc3feccd573feab9655a7a5.exe
Size

187KB
MD5

cbf5bdb17cc3feccd573feab9655a7a5
SHA1

4c84a7476992912952ffa3f7438f919e4f8fe90b
SHA256

cf2cbad1f955dc1576733d0398c8eb6985d940a53237ba1bb0be1ac1f2ad6281
SHA512

20330a3601a979e3bf3d018de38b827f2d868e6c8642042cb875a9a0db39849ac255aa324976d2eebf16f7aedc3b843327f32044e78b265a273eb0862eabba88
SSDEEP

768:jeTDbPFalhisURRRVpRdNtAEaTtKmxFeMN1sDKZMbai8PK6LM5vjvVXS0gz41qjJ:jeHbPFcW3AEWgm3j1+uq6BN

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\ProgramData\\application data\\Microsoft\\KBDriver\\kbsys.exe\""	DirLock.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	DirLock.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	DirLock.exe

Executes dropped EXE 9 IoCs

pid	Process
4976	DirLock.exe
4992	2.exe
2168	winnthlp1.exe
1320	winnthlp2.exe
3604	lsass.exe
4500	2.exe
3528	2.exe
3172	winnthlp1.exe
4288	winnthlp2.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DirLock = "C:\\ProgramData\\application data\\Lambda\\DirLock.exe"	DirLock.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LSAgent = "C:\\Windows\\lsass.exe"	DirLock.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\system.exe"	DirLock.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	DirLock.exe
File opened for modification	F:\autorun.inf	DirLock.exe
File created	F:\autorun.inf	DirLock.exe
File opened for modification	C:\autorun.inf	DirLock.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\sppui.exe	winnthlp1.exe
File created	C:\Windows\SysWOW64\wbem.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\zh-TW.exe	winnthlp1.exe
File created	C:\Windows\SysWOW64\slmgr.exe	winnthlp2.exe
File created	C:\Windows\SysWOW64\de.exe	winnthlp1.exe
File created	C:\Windows\SysWOW64\icsxml.exe	winnthlp2.exe
File created	C:\Windows\SysWOW64\GroupPolicyUsers.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\it	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\Speech_OneCore	winnthlp2.exe
File created	C:\Windows\SysWOW64\MUI.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\NDF	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\spp	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\RasToast	winnthlp1.exe
File created	C:\Windows\SysWOW64\cs-CZ.exe	winnthlp2.exe
File created	C:\Windows\SysWOW64\fr.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\ko-KR	winnthlp1.exe
File created	C:\Windows\SysWOW64\MailContactsCalendarSync.exe	winnthlp1.exe
File created	C:\Windows\SysWOW64\sru.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\lt-LT	winnthlp1.exe
File created	C:\Windows\SysWOW64\sk-SK.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\pt-PT.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\ro-RO.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\en.exe	winnthlp1.exe
File created	C:\Windows\SysWOW64\th-TH.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\en.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\icsxml.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\MailContactsCalendarSync.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\config	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\he-IL	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\he-IL.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\sv-SE	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\RasToast.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\bg-BG	winnthlp2.exe
File created	C:\Windows\SysWOW64\hr-HR.exe	winnthlp2.exe
File created	C:\Windows\SysWOW64\sppui.exe	winnthlp1.exe
File created	C:\Windows\SysWOW64\sysprep.exe	winnthlp1.exe
File created	C:\Windows\SysWOW64\icsxml.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\Ipmi.exe	winnthlp1.exe
File created	C:\Windows\SysWOW64\sv-SE.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\SMI.exe	winnthlp2.exe
File created	C:\Windows\SysWOW64\Speech_OneCore.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\th-TH	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\winnthlp2\Classified.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\icsxml	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\fr-CA	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\Printing_Admin_Scripts.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\Tasks.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\winnthlp1\Classified.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\lt-LT	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\ja.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\MailContactsCalendarSync	winnthlp2.exe
File created	C:\Windows\SysWOW64\migration.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\ar-SA	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\catroot.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy.exe	winnthlp1.exe
File created	C:\Windows\SysWOW64\ja-JP.exe	winnthlp2.exe
File created	C:\Windows\SysWOW64\sru.exe	winnthlp1.exe
File created	C:\Windows\SysWOW64\pl-PL.exe	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\WCN	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\RasToast	winnthlp2.exe
File opened for modification	C:\Windows\SysWOW64\config	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\InstallShield.exe	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\Ipmi	winnthlp1.exe
File opened for modification	C:\Windows\SysWOW64\winrm.exe	winnthlp2.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Google.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Microsoft	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\MSBuild.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Common Files\Classified.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Adobe.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Common Files.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Microsoft.NET.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Windows NT.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Common Files\System.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Microsoft.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Common Files\Services	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Common Files\Services.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Common Files\System	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Adobe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Common Files.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Google	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Windows Mail.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Windows Defender.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Common Files\Java.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Common Files\System.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Windows NT.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Classified.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Common Files\Oracle.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Adobe.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\MSBuild	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\MSBuild.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Windows Photo Viewer.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Classified.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Common Files\Services.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Windows Defender	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Windows Mail.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Windows Media Player.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Reference Assemblies.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Windows Defender.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Windows NT	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Windows Portable Devices.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Common Files\Adobe.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Internet Explorer.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Microsoft.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Program Files (x86)\Google.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\it-IT	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Windows\Registration.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\ServiceState.exe	winnthlp2.exe
File created	C:\Windows\servicing.exe	winnthlp2.exe
File opened for modification	C:\Windows\OCR	winnthlp1.exe
File opened for modification	C:\Windows\ServiceState.exe	winnthlp2.exe
File opened for modification	C:\Windows\GameBarPresenceWriter	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\Speech_OneCore	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\system.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\diagnostics	winnthlp1.exe
File opened for modification	C:\Windows\servicing	winnthlp2.exe
File opened for modification	C:\Windows\WaaS.exe	winnthlp1.exe
File created	C:\Windows\Boot.exe	winnthlp1.exe
File opened for modification	C:\Windows\it-IT.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\OCR	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Windows\RemotePackages.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\Boot.exe	winnthlp1.exe
File opened for modification	C:\Windows\ServiceState.exe	winnthlp1.exe
File opened for modification	C:\Windows\servicing.exe	winnthlp1.exe
File created	C:\Windows\rescache.exe	winnthlp1.exe
File created	C:\Windows\System.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\uk-UA.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Windows\CbsTemp.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\DigitalLocker	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\fr-FR	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\Help	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\IdentityCRL	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Windows\SchCache.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\CSC	winnthlp1.exe
File opened for modification	C:\Windows\Branding	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\OCR.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Windows\Resources.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\SoftwareDistribution	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Windows\WinSxS.exe	winnthlp2.exe
File opened for modification	C:\Windows\TAPI.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\appcompat.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Windows\Speech_OneCore.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Windows\System32.exe	winnthlp2.exe
File created	C:\Windows\ServiceState.exe	winnthlp2.exe
File created	C:\Windows\System32.exe	winnthlp2.exe
File created	C:\Windows\ImmersiveControlPanel.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\security	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\servicing	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Windows\Speech.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\SysWOW64	winnthlp1.exe
File opened for modification	C:\Windows\Boot	winnthlp2.exe
File created	C:\Windows\CSC.exe	winnthlp2.exe
File created	C:\Windows\en-US.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Windows\INF.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\SysWOW64	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Windows\SystemResources.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Windows\Vss.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\system.exe	DirLock.exe
File created	C:\Windows\appcompat.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Windows\L2Schemas.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\Vss	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Windows\system.exe	DirLock.exe
File opened for modification	C:\Windows\bcastdvr	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\PolicyDefinitions.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File created	C:\Windows\WaaS.exe	winnthlp1.exe
File opened for modification	C:\Windows\system.exe	winnthlp2.exe
File opened for modification	C:\Windows\appcompat	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\Help.exe	cbf5bdb17cc3feccd573feab9655a7a5.exe
File opened for modification	C:\Windows\OCR	winnthlp1.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\1\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000005a583d7112004170704461746100400009000400efbe5a583d716f581c892e00000082e10100000001000000000000000000000000000000966b48004100700070004400610074006100000016000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e003100000000006f581d89100054656d7000003a0009000400efbe5a583d716f581d892e00000096e10100000001000000000000000000000000000000b76ff100540065006d007000000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000005a583d711100557365727300640009000400efbe874f77486f581c892e000000c70500000000010000000000000000003a00000000002f07650055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = 8a003100000000006f581d8916004342463542447e310000720009000400efbe6f581d896f581d892e0000000f320200000007000000000000000000000000000000b76ff10063006200660035006200640062003100370063006300330066006500630063006400350037003300660065006100620039003600350035006100370061003500000018000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1 = 56003100000000006f582089160057696e646f777300400009000400efbe874f77486f5820892e0000000006000000000100000000000000000000000000000050878800570069006e0064006f0077007300000016000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\1\NodeSlot = "3"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0 = 5a003100000000006f5822891600537973574f5736340000420009000400efbe874fdb496f5822892e000000121300000000010000000000000000000000000000005c5b1c0153007900730057004f00570036003400000018000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\1 = 5c003100000000006f582289160057494e4e54487e320000440009000400efbe6f5822896f5822892e000000e93202000000080000000000000000000000000000005c5b1c01770069006e006e00740068006c0070003200000018000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000005a58837e100041646d696e003c0009000400efbe5a583d716f581c892e00000077e10100000001000000000000000000000000000000b6d50e00410064006d0069006e00000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\0\NodeSlot = "2"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
2448	explorer.exe
4196	explorer.exe
2708	explorer.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	980	vssvc.exe
Token: SeRestorePrivilege	980	vssvc.exe
Token: SeAuditPrivilege	980	vssvc.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
4272	cbf5bdb17cc3feccd573feab9655a7a5.exe
4976	DirLock.exe
4992	2.exe
2448	explorer.exe
2448	explorer.exe
2168	winnthlp1.exe
1320	winnthlp2.exe
3604	lsass.exe
4196	explorer.exe
4196	explorer.exe
4500	2.exe
2708	explorer.exe
2708	explorer.exe
3528	2.exe
3172	winnthlp1.exe
4288	winnthlp2.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 3740	4272	cbf5bdb17cc3feccd573feab9655a7a5.exe	91
PID 4272 wrote to memory of 3740	4272	cbf5bdb17cc3feccd573feab9655a7a5.exe	91
PID 4272 wrote to memory of 3740	4272	cbf5bdb17cc3feccd573feab9655a7a5.exe	91
PID 4272 wrote to memory of 4976	4272	cbf5bdb17cc3feccd573feab9655a7a5.exe	93
PID 4272 wrote to memory of 4976	4272	cbf5bdb17cc3feccd573feab9655a7a5.exe	93
PID 4272 wrote to memory of 4976	4272	cbf5bdb17cc3feccd573feab9655a7a5.exe	93
PID 4976 wrote to memory of 4992	4976	DirLock.exe	94
PID 4976 wrote to memory of 4992	4976	DirLock.exe	94
PID 4976 wrote to memory of 4992	4976	DirLock.exe	94
PID 4992 wrote to memory of 2168	4992	2.exe	95
PID 4992 wrote to memory of 2168	4992	2.exe	95
PID 4992 wrote to memory of 2168	4992	2.exe	95
PID 4992 wrote to memory of 1320	4992	2.exe	96
PID 4992 wrote to memory of 1320	4992	2.exe	96
PID 4992 wrote to memory of 1320	4992	2.exe	96
PID 4272 wrote to memory of 3604	4272	cbf5bdb17cc3feccd573feab9655a7a5.exe	98
PID 4272 wrote to memory of 3604	4272	cbf5bdb17cc3feccd573feab9655a7a5.exe	98
PID 4272 wrote to memory of 3604	4272	cbf5bdb17cc3feccd573feab9655a7a5.exe	98
PID 2168 wrote to memory of 644	2168	winnthlp1.exe	104
PID 2168 wrote to memory of 644	2168	winnthlp1.exe	104
PID 2168 wrote to memory of 644	2168	winnthlp1.exe	104
PID 1320 wrote to memory of 1580	1320	winnthlp2.exe	140
PID 1320 wrote to memory of 1580	1320	winnthlp2.exe	140
PID 1320 wrote to memory of 1580	1320	winnthlp2.exe	140
PID 4976 wrote to memory of 4500	4976	DirLock.exe	110
PID 4976 wrote to memory of 4500	4976	DirLock.exe	110
PID 4976 wrote to memory of 4500	4976	DirLock.exe	110
PID 3604 wrote to memory of 3528	3604	lsass.exe	111
PID 3604 wrote to memory of 3528	3604	lsass.exe	111
PID 3604 wrote to memory of 3528	3604	lsass.exe	111
PID 4500 wrote to memory of 3172	4500	2.exe	112
PID 4500 wrote to memory of 3172	4500	2.exe	112
PID 4500 wrote to memory of 3172	4500	2.exe	112
PID 3528 wrote to memory of 4288	3528	2.exe	235
PID 3528 wrote to memory of 4288	3528	2.exe	235
PID 3528 wrote to memory of 4288	3528	2.exe	235
PID 3172 wrote to memory of 3360	3172	winnthlp1.exe	115
PID 3172 wrote to memory of 3360	3172	winnthlp1.exe	115
PID 3172 wrote to memory of 3360	3172	winnthlp1.exe	115
PID 4288 wrote to memory of 1756	4288	winnthlp2.exe	116
PID 4288 wrote to memory of 1756	4288	winnthlp2.exe	116
PID 4288 wrote to memory of 1756	4288	winnthlp2.exe	116

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\cbf5bdb17cc3feccd573feab9655a7a5.exe
"C:\Users\Admin\AppData\Local\Temp\cbf5bdb17cc3feccd573feab9655a7a5.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\SysWOW64\explorer.exe
  explorer C:\Users\Admin\AppData\Local\Temp\cbf5bdb17cc3feccd573feab9655a7a5
  2⤵
  PID:3740
- C:\ProgramData\application data\Lambda\DirLock.exe
  "C:\ProgramData\application data\Lambda\DirLock.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops autorun.inf file
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Users\Admin\AppData\Local\Temp\lgiu2j-lcij6j-gza6nn-4x2sc0-nlmdeh\2.exe
    C:\Users\Admin\AppData\Local\Temp\lgiu2j-lcij6j-gza6nn-4x2sc0-nlmdeh\2.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2168
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:644
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1320
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:1580
- - C:\Users\Admin\AppData\Local\Temp\paa0wb-w0lij4-lnrmsf-gfu0zk-t4r1t7\2.exe
    C:\Users\Admin\AppData\Local\Temp\paa0wb-w0lij4-lnrmsf-gfu0zk-t4r1t7\2.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4500
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3172
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:3360
- - C:\Users\Admin\AppData\Local\Temp\6dc8xl-7416ck-3li33o-sezy2z-mbd3z5\2.exe
    C:\Users\Admin\AppData\Local\Temp\6dc8xl-7416ck-3li33o-sezy2z-mbd3z5\2.exe
    3⤵
    PID:3364
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:3168
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:3808
- - C:\Users\Admin\AppData\Local\Temp\9hwbg9-h2w1c1-gywqh1-cloey6-0jgzmi\2.exe
    C:\Users\Admin\AppData\Local\Temp\9hwbg9-h2w1c1-gywqh1-cloey6-0jgzmi\2.exe
    3⤵
    PID:2688
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:4228
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:3168
- - C:\Users\Admin\AppData\Local\Temp\9dduob-byr1d9-io2jz2-7c8n9d-23b1fj\2.exe
    C:\Users\Admin\AppData\Local\Temp\9dduob-byr1d9-io2jz2-7c8n9d-23b1fj\2.exe
    3⤵
    PID:4832
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:1476
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5040
- - C:\Users\Admin\AppData\Local\Temp\82d395-hh13gw-i8r1uv-o3d96p-cwu451\2.exe
    C:\Users\Admin\AppData\Local\Temp\82d395-hh13gw-i8r1uv-o3d96p-cwu451\2.exe
    3⤵
    PID:4852
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:1668
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:888
- - C:\Users\Admin\AppData\Local\Temp\t6hvh5-y88kr0-f7em8i-5p90rs-aq7ztn\2.exe
    C:\Users\Admin\AppData\Local\Temp\t6hvh5-y88kr0-f7em8i-5p90rs-aq7ztn\2.exe
    3⤵
    PID:5336
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5432
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5832
- - C:\Users\Admin\AppData\Local\Temp\4bq9gz-nzauig-yzucr5-5p5udy-ucbyn9\2.exe
    C:\Users\Admin\AppData\Local\Temp\4bq9gz-nzauig-yzucr5-5p5udy-ucbyn9\2.exe
    3⤵
    PID:5256
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:4772
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5276
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5392
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5800
- - C:\Users\Admin\AppData\Local\Temp\bm0eba-obxf4x-65sqwe-7vhoae-dr4wm8\2.exe
    C:\Users\Admin\AppData\Local\Temp\bm0eba-obxf4x-65sqwe-7vhoae-dr4wm8\2.exe
    3⤵
    PID:5484
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5492
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5760
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:4552
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5624
- - C:\Users\Admin\AppData\Local\Temp\so3nsb-d7bh4r-p1k9of-xmkzk7-wilop7\2.exe
    C:\Users\Admin\AppData\Local\Temp\so3nsb-d7bh4r-p1k9of-xmkzk7-wilop7\2.exe
    3⤵
    PID:2540
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5172
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5244
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5292
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5848
- - C:\Users\Admin\AppData\Local\Temp\jvdppm-6t6bez-phpwgg-r2334e-ysekq7\2.exe
    C:\Users\Admin\AppData\Local\Temp\jvdppm-6t6bez-phpwgg-r2334e-ysekq7\2.exe
    3⤵
    PID:4476
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5832
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5784
- - C:\Users\Admin\AppData\Local\Temp\lef1an-g6ifhs-tvfgbf-boas2x-cf0phw\2.exe
    C:\Users\Admin\AppData\Local\Temp\lef1an-g6ifhs-tvfgbf-boas2x-cf0phw\2.exe
    3⤵
    PID:5952
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5872
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:3620
- - C:\Users\Admin\AppData\Local\Temp\ybik9g-m4zf8r-g1dk5y-swmbol-0gm2le\2.exe
    C:\Users\Admin\AppData\Local\Temp\ybik9g-m4zf8r-g1dk5y-swmbol-0gm2le\2.exe
    3⤵
    PID:6024
- - C:\Users\Admin\AppData\Local\Temp\vc0qm8-rysd3d-5ieo7z-xl4kt6-z6iri4\2.exe
    C:\Users\Admin\AppData\Local\Temp\vc0qm8-rysd3d-5ieo7z-xl4kt6-z6iri4\2.exe
    3⤵
    PID:5972
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:1240
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5292
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5892
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:3856
- - C:\Users\Admin\AppData\Local\Temp\asdtmn-0fjxwy-u7mc23-7wjdwq-qqeoo8\2.exe
    C:\Users\Admin\AppData\Local\Temp\asdtmn-0fjxwy-u7mc23-7wjdwq-qqeoo8\2.exe
    3⤵
    PID:4288
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:2668
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:1456
- - C:\Users\Admin\AppData\Local\Temp\4tkq7b-ap7zj5-ziouih-j0wntx-vv5fdl\2.exe
    C:\Users\Admin\AppData\Local\Temp\4tkq7b-ap7zj5-ziouih-j0wntx-vv5fdl\2.exe
    3⤵
    PID:6380
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:6472
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:6832
- - C:\Users\Admin\AppData\Local\Temp\jx7f6p-9e2sqz-ef0rst-szm1wf-bn6mxw\2.exe
    C:\Users\Admin\AppData\Local\Temp\jx7f6p-9e2sqz-ef0rst-szm1wf-bn6mxw\2.exe
    3⤵
    PID:5616
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:3968
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:1624
- - C:\Users\Admin\AppData\Local\Temp\knasa4-rdl9wx-h0re68-bsuscd-ohrt60\2.exe
    C:\Users\Admin\AppData\Local\Temp\knasa4-rdl9wx-h0re68-bsuscd-ohrt60\2.exe
    3⤵
    PID:6960
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7060
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5560
- - C:\Users\Admin\AppData\Local\Temp\gylleh-gpajth-mkxr5a-1y8bjw-vvmgg2\2.exe
    C:\Users\Admin\AppData\Local\Temp\gylleh-gpajth-mkxr5a-1y8bjw-vvmgg2\2.exe
    3⤵
    PID:6740
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:1952
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:1128
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:6228
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:4128
- - C:\Users\Admin\AppData\Local\Temp\vt7c83-3e735w-3a8s9w-zx0fq0-mvs1fd\2.exe
    C:\Users\Admin\AppData\Local\Temp\vt7c83-3e735w-3a8s9w-zx0fq0-mvs1fd\2.exe
    3⤵
    PID:6716
- - C:\Users\Admin\AppData\Local\Temp\rgbevb-t1plka-0r1263-ztdi04-ulgw79\2.exe
    C:\Users\Admin\AppData\Local\Temp\rgbevb-t1plka-0r1263-ztdi04-ulgw79\2.exe
    3⤵
    PID:1828
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:756
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:4148
- - C:\Users\Admin\AppData\Local\Temp\pgttt9-7ao4kq-81d2zp-4iuzqt-tabup5\2.exe
    C:\Users\Admin\AppData\Local\Temp\pgttt9-7ao4kq-81d2zp-4iuzqt-tabup5\2.exe
    3⤵
    PID:116
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:6472
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:2488
- - C:\Users\Admin\AppData\Local\Temp\j51lxz-ml41ww-3ka3df-3gbshf-y33gyj\2.exe
    C:\Users\Admin\AppData\Local\Temp\j51lxz-ml41ww-3ka3df-3gbshf-y33gyj\2.exe
    3⤵
    PID:3692
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:4852
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:3336
- - C:\Users\Admin\AppData\Local\Temp\r9656p-kcw1tw-mxa8hv-tnlq3o-iarudy\2.exe
    C:\Users\Admin\AppData\Local\Temp\r9656p-kcw1tw-mxa8hv-tnlq3o-iarudy\2.exe
    3⤵
    PID:3672
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5948
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:6944
- - C:\Users\Admin\AppData\Local\Temp\xad4kz-aza5em-tt5h54-tkufk3-zfhnwx\2.exe
    C:\Users\Admin\AppData\Local\Temp\xad4kz-aza5em-tt5h54-tkufk3-zfhnwx\2.exe
    3⤵
    PID:7540
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7584
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:8164
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7668
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:8084
- - C:\Users\Admin\AppData\Local\Temp\54d3o6-pmlxzm-1huoj9-91uff2-9yv4k2\2.exe
    C:\Users\Admin\AppData\Local\Temp\54d3o6-pmlxzm-1huoj9-91uff2-9yv4k2\2.exe
    3⤵
    PID:1624
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7632
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:2440
- - C:\Users\Admin\AppData\Local\Temp\2m3r6k-pkvcvw-98fxwd-k8zf62-ryaxsv\2.exe
    C:\Users\Admin\AppData\Local\Temp\2m3r6k-pkvcvw-98fxwd-k8zf62-ryaxsv\2.exe
    3⤵
    PID:7764
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5872
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:1152
- - C:\Users\Admin\AppData\Local\Temp\7p0oyt-2g435y-f614zl-xzwfq3-yqld42\2.exe
    C:\Users\Admin\AppData\Local\Temp\7p0oyt-2g435y-f614zl-xzwfq3-yqld42\2.exe
    3⤵
    PID:7632
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:8088
- C:\Windows\lsass.exe
  C:\Windows\lsass.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Users\Admin\AppData\Local\Temp\wqww7f-wnxkbf-s9o8sj-f7huhw-zv0eic\2.exe
    C:\Users\Admin\AppData\Local\Temp\wqww7f-wnxkbf-s9o8sj-f7huhw-zv0eic\2.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3528
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4288
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:1756
- - C:\Users\Admin\AppData\Local\Temp\rj76lp-y9io7i-oxoshs-ior6ny-vdp7hl\2.exe
    C:\Users\Admin\AppData\Local\Temp\rj76lp-y9io7i-oxoshs-ior6ny-vdp7hl\2.exe
    3⤵
    PID:3024
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:4528
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:648
- - C:\Users\Admin\AppData\Local\Temp\okq7hn-pbg5vm-mrw2mq-akdxm1-4hs2i8\2.exe
    C:\Users\Admin\AppData\Local\Temp\okq7hn-pbg5vm-mrw2mq-akdxm1-4hs2i8\2.exe
    3⤵
    PID:5016
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:4344
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:3276
- - C:\Users\Admin\AppData\Local\Temp\6jbcdc-e4b395-e0bsd5-9m3gu9-xkw1jm\2.exe
    C:\Users\Admin\AppData\Local\Temp\6jbcdc-e4b395-e0bsd5-9m3gu9-xkw1jm\2.exe
    3⤵
    PID:1580
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:1844
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:3200
- - C:\Users\Admin\AppData\Local\Temp\xho2pe-z229ed-6sdq06-vfju9g-q7m9gm\2.exe
    C:\Users\Admin\AppData\Local\Temp\xho2pe-z229ed-6sdq06-vfju9g-q7m9gm\2.exe
    3⤵
    PID:3004
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:1700
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:1836
- - C:\Users\Admin\AppData\Local\Temp\r57639-zkw6a0-0bl4oz-678c0t-vzp7z5\2.exe
    C:\Users\Admin\AppData\Local\Temp\r57639-zkw6a0-0bl4oz-678c0t-vzp7z5\2.exe
    3⤵
    PID:5312
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5400
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5920
- - C:\Users\Admin\AppData\Local\Temp\2ahpbk-4qj6ai-mpq8r0-c7klaa-h8ikc5\2.exe
    C:\Users\Admin\AppData\Local\Temp\2ahpbk-4qj6ai-mpq8r0-c7klaa-h8ikc5\2.exe
    3⤵
    PID:5288
- - C:\Users\Admin\AppData\Local\Temp\7nvhx8-qbf2yp-2bzk8e-91a2u7-yog63i\2.exe
    C:\Users\Admin\AppData\Local\Temp\7nvhx8-qbf2yp-2bzk8e-91a2u7-yog63i\2.exe
    3⤵
    PID:5464
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5044
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5424
- - C:\Users\Admin\AppData\Local\Temp\qiym7q-37wn0d-l1rzsv-mrgx6u-sn35io\2.exe
    C:\Users\Admin\AppData\Local\Temp\qiym7q-37wn0d-l1rzsv-mrgx6u-sn35io\2.exe
    3⤵
    PID:6000
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:1836
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:5420
- - C:\Users\Admin\AppData\Local\Temp\qjmpsz-a2uj4f-mx3an3-uh31kv-ud4qov\2.exe
    C:\Users\Admin\AppData\Local\Temp\qjmpsz-a2uj4f-mx3an3-uh31kv-ud4qov\2.exe
    3⤵
    PID:5292
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5764
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:1836
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:6072
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:6136
- - C:\Users\Admin\AppData\Local\Temp\gc7ikc-3az49o-nyjoa5-ojwwz3-v98dlw\2.exe
    C:\Users\Admin\AppData\Local\Temp\gc7ikc-3az49o-nyjoa5-ojwwz3-v98dlw\2.exe
    3⤵
    PID:3968
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:4356
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5264
- - C:\Users\Admin\AppData\Local\Temp\8pw8lw-2h0ns1-f6xomo-y0szd6-yqhxs5\2.exe
    C:\Users\Admin\AppData\Local\Temp\8pw8lw-2h0ns1-f6xomo-y0szd6-yqhxs5\2.exe
    3⤵
    PID:6348
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:6432
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:6748
- - C:\Users\Admin\AppData\Local\Temp\mv6lzv-bnngy6-4l2lvc-hfade0-o0a3bs\2.exe
    C:\Users\Admin\AppData\Local\Temp\mv6lzv-bnngy6-4l2lvc-hfade0-o0a3bs\2.exe
    3⤵
    PID:6076
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:5260
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:6404
- - C:\Users\Admin\AppData\Local\Temp\4wchwp-zj45dt-d2qfhf-65gb3m-8ruisl\2.exe
    C:\Users\Admin\AppData\Local\Temp\4wchwp-zj45dt-d2qfhf-65gb3m-8ruisl\2.exe
    3⤵
    PID:6992
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7076
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:6148
- - C:\Users\Admin\AppData\Local\Temp\3ivfh8-t51jqj-nx4xxo-0m2yrb-jfx9it\2.exe
    C:\Users\Admin\AppData\Local\Temp\3ivfh8-t51jqj-nx4xxo-0m2yrb-jfx9it\2.exe
    3⤵
    PID:6908
- - C:\Users\Admin\AppData\Local\Temp\jdhalx-p94jxr-e1ldw2-ykt78i-ae2zs6\2.exe
    C:\Users\Admin\AppData\Local\Temp\jdhalx-p94jxr-e1ldw2-ykt78i-ae2zs6\2.exe
    3⤵
    PID:7116
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:7100
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:4340
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:3968
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:4384
- - C:\Users\Admin\AppData\Local\Temp\7f7z0p-xx1ckz-2xzbmu-ghllqg-z556rx\2.exe
    C:\Users\Admin\AppData\Local\Temp\7f7z0p-xx1ckz-2xzbmu-ghllqg-z556rx\2.exe
    3⤵
    PID:7152
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5200
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:6536
- - C:\Users\Admin\AppData\Local\Temp\kubswf-rkmai8-g7sesi-bzvsyo-oottsb\2.exe
    C:\Users\Admin\AppData\Local\Temp\kubswf-rkmai8-g7sesi-bzvsyo-oottsb\2.exe
    3⤵
    PID:1224
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:5972
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5104
- - C:\Users\Admin\AppData\Local\Temp\2uo5ju-3ld3xt-9g0b9n-oubuo9-hsp0kf\2.exe
    C:\Users\Admin\AppData\Local\Temp\2uo5ju-3ld3xt-9g0b9n-oubuo9-hsp0kf\2.exe
    3⤵
    PID:6400
  - - C:\Windows\SysWOW64\winnthlp1.exe
      C:\Windows\system32\winnthlp1.exe
      4⤵
      PID:6340
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp1
        5⤵
        
        PID:5972
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:3872
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:6420
- - C:\Users\Admin\AppData\Local\Temp\7zc1rm-fkcsoe-fgdhsf-a2559j-y1xqyv\2.exe
    C:\Users\Admin\AppData\Local\Temp\7zc1rm-fkcsoe-fgdhsf-a2559j-y1xqyv\2.exe
    3⤵
    PID:5280
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:1524
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:6904
- - C:\Users\Admin\AppData\Local\Temp\74i81s-8pwfpr-ff8xck-ehkc6l-99nrcq\2.exe
    C:\Users\Admin\AppData\Local\Temp\74i81s-8pwfpr-ff8xck-ehkc6l-99nrcq\2.exe
    3⤵
    PID:6840
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:6756
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:7240
- - C:\Users\Admin\AppData\Local\Temp\hyvzdd-zsqa4u-0jf8jt-w0v5ax-lsc099\2.exe
    C:\Users\Admin\AppData\Local\Temp\hyvzdd-zsqa4u-0jf8jt-w0v5ax-lsc099\2.exe
    3⤵
    PID:7624
- - C:\Users\Admin\AppData\Local\Temp\kjky20-mzne1y-4ytgig-3uu5mg-zhms3l\2.exe
    C:\Users\Admin\AppData\Local\Temp\kjky20-mzne1y-4ytgig-3uu5mg-zhms3l\2.exe
    3⤵
    PID:7548
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7688
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:8108
- - C:\Users\Admin\AppData\Local\Temp\kiirhf-cl8n4m-e7musk-lwyced-ak3goo\2.exe
    C:\Users\Admin\AppData\Local\Temp\kiirhf-cl8n4m-e7musk-lwyced-ak3goo\2.exe
    3⤵
    PID:7596
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7656
    - - C:\Windows\SysWOW64\explorer.exe
        
        explorer C:\Windows\SysWOW64\winnthlp2
        5⤵
        
        PID:6944
- - C:\Users\Admin\AppData\Local\Temp\wfrirg-94pjl3-sykudl-sp9srk-ykv03e\2.exe
    C:\Users\Admin\AppData\Local\Temp\wfrirg-94pjl3-sykudl-sp9srk-ykv03e\2.exe
    3⤵
    PID:7640
  - - C:\Windows\SysWOW64\winnthlp2.exe
      C:\Windows\system32\winnthlp2.exe
      4⤵
      PID:7608

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2448

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3056

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:980

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4196

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2708

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3724

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2940

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4376

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3384

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2760

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:868

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:968

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3252

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3168

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2908

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6096

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3520

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5996

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4392

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5824

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5444

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5912

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4792

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5752

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5236

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5636

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3332

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4860

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5868

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5332

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2188

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3856

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6252

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7008

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4824

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6272

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6764

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2728

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6680

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5904

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6380

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3624

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6404

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3548

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1080

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6572

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6184

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2512

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6160

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6348

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6852

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7248

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7452

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6720

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7488

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2536

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:7320

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:8040

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\acrocef_low.exe

Filesize
187KB

MD5
cbf5bdb17cc3feccd573feab9655a7a5

SHA1
4c84a7476992912952ffa3f7438f919e4f8fe90b

SHA256
cf2cbad1f955dc1576733d0398c8eb6985d940a53237ba1bb0be1ac1f2ad6281

SHA512
20330a3601a979e3bf3d018de38b827f2d868e6c8642042cb875a9a0db39849ac255aa324976d2eebf16f7aedc3b843327f32044e78b265a273eb0862eabba88

Download Submit
C:\Windows\shutdown.dll

Filesize
31B

MD5
b70ed9a5e09ad0e4c2e55df4bbded575

SHA1
34170a65f8a2d9f2273f69fa4115e46197e1db53

SHA256
1b0f2beca8a0a79f689143a712f55f1721fcc3f540e9696d53204cd6db003ba3

SHA512
c4a6bdbe44cc414534465b6d128708e337f73bfc23c79dfc877c27e569cabb0ca90b8d04c15cc6edc91abce112df11c164ba37df1f40b1fc70eed69cd0130b17

Download Submit
C:\Windows\shutdown.dll

Filesize
31B

MD5
c23961df4551bec45cfa91f9b0793cfc

SHA1
b3cb3cf9b13184df073b5262e7b3514f49cad29f

SHA256
4cdf2dad937a1754b576d6af111d9c9291900e7597607adcb7074b1c58eb04ef

SHA512
ac3bdb0aa81e641443ad4c5b8844564e31997a400cddf0bad5a8e35d216691571d3b9179dfe66d91e9f2c0c6cb1beebbc6a5e9c17e17aeaf969e59812ab704b4

Download Submit
F:\autorun.inf

Filesize
253B

MD5
b775a5a4faab19e5c95c75e3461b2725

SHA1
744ad2a2d65b0fd4f83cd46ba8097cae27fda264

SHA256
826327d415e365d8e8eb6f4ef70b8098e2a54fde194a7bc149b7322fd4d8fc2f

SHA512
587efb9c1469df6e08ea0aa9e58b3a70db3a5481fdf4cb225785b5a597443621eaebe678998cabaa3b8c795a4250af7efb1b884826a3bb6f188a6ddd64ecb735

Download Submit
memory/1240-2834-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1320-1108-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1476-1645-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1580-1537-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1668-1775-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1700-1774-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1836-2560-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1844-1646-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2168-1107-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2540-2180-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2688-1403-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3004-1671-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3024-1269-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3168-1379-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3172-1242-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3364-1266-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3528-1136-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3968-2859-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4228-1511-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4272-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4272-452-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4288-1243-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4344-1510-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4356-2977-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4476-2315-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4500-1135-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4528-1378-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4552-2160-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4772-1928-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4772-2047-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4832-1538-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4852-1672-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4976-3139-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4976-384-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4992-424-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5016-1400-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5044-2426-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5172-2289-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5256-1937-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5292-2572-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5292-2590-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5292-2290-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5312-1799-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5336-1800-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5392-2046-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5400-1910-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5432-1909-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5464-2318-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5484-2066-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5492-2161-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5616-3147-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5764-2702-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5832-2425-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5872-2561-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5892-2835-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5952-2453-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5972-2721-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/6000-2450-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/6024-2586-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/6072-2701-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/6076-3146-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/6348-2989-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/6348-3010-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/6380-3003-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads